Assurance on non-financial information: ISAE 3000
What kinds of engagement fall under ISAE 3000 (Revised), how reasonable and limited assurance differ, and how a firm sets one up and documents it.
By Achekam · · 5 min read · For Accountants & audit firms in South Africa, Nigeria, Kenya
A donor wants assurance that a non-profit spent a grant on the activities it was given for. A lender asks for an independent report on a borrower's compliance with its covenants. A listed client wants its key performance indicators assured before they go in the integrated report. None of these is an audit of financial statements, and none is a review. They are assurance engagements on something else, and the standard that governs most of them is ISAE 3000 (Revised), Assurance Engagements Other than Audits or Reviews of Historical Financial Information.
For small and medium firms, ISAE 3000 work often arrives unexpectedly, as a request from an existing client with a deadline attached. The firms that handle it well are the ones that recognise early what kind of engagement it is, and do not try to run it through an audit template.
Subject matter beyond historical financial statements
ISAE 3000 (Revised) covers assurance on a wide range of underlying subject matter: performance information, compliance with laws, regulations or contract terms, the design or operation of controls, non-financial information in annual and sustainability reports, and more. Some subjects have their own standards built on ISAE 3000, such as ISAE 3402 for controls at a service organisation and ISAE 3410 for greenhouse gas statements, and the IAASB has issued a separate standard for sustainability assurance.
Every engagement has the same elements: a three-party relationship between the practitioner, the responsible party and the intended users; an underlying subject matter; criteria against which it is measured or evaluated; evidence; and a written assurance report.
One distinction matters at acceptance: in an attestation engagement, someone other than the practitioner measures or evaluates the subject matter, and the practitioner reports on that information; in a direct engagement, the practitioner does the measuring or evaluating.
Reasonable and limited assurance
| Reasonable assurance | Limited assurance | |
|---|---|---|
| Level of assurance | High, but not absolute | Meaningful, but lower |
| Procedures | Sufficient to reduce engagement risk to an acceptably low level | Limited in nature, timing or extent compared with reasonable assurance |
| Conclusion | Expressed positively: the subject matter is, in all material respects, in accordance with the criteria | Expressed negatively: nothing has come to the practitioner's attention that causes them to believe it is materially misstated |
Users often ask for "an audit" of something when limited assurance would meet their need, or the reverse. Agree the level explicitly, in writing, before work starts.
An agreed-upon procedures engagement under ISRS 4400 (Revised) is different again: it gives no assurance, only factual findings, and is sometimes the better answer for a funder; see agreed-upon procedures under ISRS 4400.
Suitable criteria and the responsible party
ISAE 3000 (Revised) sets preconditions before an engagement can be accepted. The roles of the parties must be suitable, the subject matter appropriate, and the criteria suitable and available to the intended users. Suitable criteria are relevant, complete, reliable, neutral and understandable. The practitioner must expect to obtain the evidence needed, and the engagement must have a rational purpose.
Criteria are where these engagements most often fail. "The KPIs are accurate" is not a criterion. "Customer complaints are counted as every written complaint logged in the CRM system in the period, as defined in the reporting basis on page x" is. If the client has no written basis of preparation, part of the engagement is helping it write one before assurance can be given.
In Nigeria and Kenya, demand for sustainability assurance is coming. Under the FRC's amended roadmap, IFRS sustainability reporting becomes mandatory for Nigerian public interest entities for periods beginning on or after 1 January 2028 and for SMEs from 1 January 2030, with assurance starting from the third reporting year. Under ICPAK's roadmap, it becomes mandatory in Kenya for public interest entities from 1 January 2027, for large non-PIEs from 1 January 2028 and for SME non-PIEs from 1 January 2029. The roadmaps are summarised in sustainability reporting roadmaps in Nigeria and Kenya.
Building the engagement from a template pack
When creating an engagement in Achekam, staff choose its type, and a firm can add its own named types. Create one for ISAE 3000 work, so assurance engagements on non-financial subjects are not mixed with audits and reviews in the engagement list.
Achekam ships working-paper template packs written in its own words, including an ISAE 3000 pack, for a firm to adopt and approve. The catalogue is marked unapproved platform content until the firm adopts it, and whether it has been installed on your deployment should be checked before planning around it. A firm's partners also keep their own methodology and working-paper templates beside Achekam's platform methodology, and a template version is published only by someone other than its author. For a subject the firm assures repeatedly, such as covenant compliance for one lender's borrowers, a firm template built on the platform pack is worth the effort.
On each work item, the procedures to perform and the documents required are listed, and a step is marked done only with a written response and its documents, or set aside with a reason; steps are never deleted. In an ISAE 3000 engagement, the written responses carry particular weight: they show how the evidence relates to each criterion.
AI can draft an engagement letter's clauses, never its fees, and a person saves the draft; Achekam will not send a letter whose wording breaks the professional guardrails. The letter should state the subject matter, the criteria, the level of assurance, the intended users and any restriction on use.
Reporting the conclusion
The assurance report identifies the subject matter and the criteria, states the level of assurance, describes the responsibilities of the responsible party and the practitioner, summarises the work performed (in more detail for limited assurance, so users understand what was and was not done), and gives the conclusion in the positive or negative form.
Achekam's Studio produces practitioner's reports for financial statements at the level chosen: audit, independent review, compilation or none. An ISAE 3000 report is outside those levels, so draft it from the firm's methodology and the standard's requirements.
The full text of ISAE 3000 (Revised) and the related assurance standards is in the IAASB's 2026 Handbook, the download page for the complete review, assurance and related services pronouncements alongside the ISQMs and ISAs.
Before you say yes
When a client asks for "assurance" on something other than its statements, ask three questions before quoting: what exactly is the subject matter, what are the criteria, and who will rely on the report? If any answer is vague, the engagement is not ready to accept.
General guidance only, not advice on your own circumstances. Tax and payroll rules change: check the current position with the authority or your adviser.
